Skip to content

IAM_LEGACY_LOGIN_ROUTES feature came

Latest
Latest

Choose a tag to compare

View all tags
@yakari007 yakari007 released this 19 Oct 14:12
· 13 commits to master since this release
v2.0.32
5142ba6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What

Two changes for deployments whose sign-in runs in the separate auth app (plusclouds/auth-v2.1).

IAM_LEGACY_LOGIN_ROUTES (config iam.oauth.legacy_login_routes, default true, so nothing changes by default). When false it removes session, login-mechanisms, fingerprint, send-otp-email, validation-status, validate-* and auth-code from /iam/authentication/oauth. access-token and revoke stay, because applications still use them.
No auth code before a second factor. A user with an active 2FA... login mechanism (an authenticator app) could still get a code from the legacy routes with the password alone, so the second factor was skippable. getValidationStatus now withholds can_get_auth_code until the session carries is_totp_validated. QR badge and Google sign-in are exempt, as they are single-factor by design (setGoogleLoginValidated now records is_google_validated).

Effect to be aware of

Users with an authenticator app can no longer finish a sign-in on pages that use the legacy routes. They need the auth app, which sets is_totp_validated.
Tested

Against a dev database, calling the legacy routes directly with throwaway users (removed afterwards): a user with an authenticator gets no code after a correct password, a user without one still gets one, and the auth app's own authenticator sign-in still produces a token. No automated tests were added to this package.

Assets 2
Loading